Cyber Brief: WordPress and F5 Exploitation, GitLab Token Risk and AI-Assisted Skimming
· 1:32:03 · Watch on YouTube ↗
Summary
A cybersecurity roundup covers exploitation of WordPress and F5 flaws, a GitLab email-token weakness, the claimed FBI data leak, an Elsevier redirect and reported AI-assisted payment skimming.
Key points
- Shiny Hunters claimed to have obtained FBI staff information. Reuters verified records for more than 22 people but could not authenticate the entire spreadsheet; the FBI said the cause remained undetermined.
- Attackers reportedly exploited an unauthenticated WordPress path traversal flaw to write executable PHP files. Administrators were advised to patch and review logs for compromise.
- Aikido Security found that a GitLab issue email token could permit code commits and CI jobs while bypassing two-factor authentication and IP restrictions. Users were advised to reset exposed tokens and search for leaked addresses.
- Elsevier said a short-lived redirect to a page associated with Lapsis did not compromise its core platforms or customer data.
- Spokane Public Schools took online systems offline after a network security incident; the cause and whether data was accessed were not disclosed.
- F5 confirmed exploitation of a BIG-IP Access Policy Manager buffer overflow in systems configured as OAuth authorization servers and released a fix.
- Gambit reported that an attacker combined AI agent frameworks to deploy payment skimmers, compromising at least 119 sites and stealing more than 600,000 valid credit records from two companies.
Article Details
- Topics
- [10:46] Shiny Hunters' claimed FBI staff data leak
- [15:38] WordPress exploitation and patching
- [22:13] Pentagon cyber capacity and AI security
- [28:32] GitLab issue email tokens and code-commit exposure
- [41:56] Elsevier redirect to a Lapsis-associated page
- [46:51] Spokane schools incident and response planning
- [53:02] Exploitation of an F5 BIG-IP flaw
- [56:57] AI-assisted payment skimming
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | lapsis[.]io | Landing page associated with Lapsis to which some Elsevier customers were redirected. |
MITRE ATT&CK
T1056.006Gambit reported that an attacker deployed payment skimmers on online retail sites to steal credit records.T1190 · Exploit Public-Facing Application[15:38] Attackers reportedly exploited an unauthenticated WordPress path traversal flaw to write executable PHP files.T1505.003 · Web ShellResearchers observed PHP payloads that execute shell commands when accessed on vulnerable WordPress sites.